Ben Vincent
7814551084
- add policies to sign/issue certificates - manage auth roles for ceph-csi, certmanager, externaldns, huntarr
74 lines
2.6 KiB
HCL
74 lines
2.6 KiB
HCL
resource "vault_kubernetes_auth_backend_role" "default" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "default"
|
|
bound_service_account_names = ["default"]
|
|
bound_service_account_namespaces = ["*"]
|
|
token_ttl = 3600
|
|
token_policies = [
|
|
"default"
|
|
]
|
|
audience = "vault"
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "demo_default" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "demo_default"
|
|
bound_service_account_names = ["default"]
|
|
bound_service_account_namespaces = ["demo"]
|
|
token_ttl = 60
|
|
token_policies = [
|
|
"kv/service/terraform/nomad"
|
|
]
|
|
audience = "vault"
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "huntarr-default" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "huntarr-default"
|
|
bound_service_account_names = ["default"]
|
|
bound_service_account_namespaces = ["huntarr"]
|
|
token_ttl = 60
|
|
token_policies = [
|
|
"pki_int/sign/servers_default",
|
|
"pki_int/issue/servers_default",
|
|
]
|
|
audience = "vault"
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "externaldns" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "externaldns"
|
|
bound_service_account_names = ["externaldns"]
|
|
bound_service_account_namespaces = ["externaldns"]
|
|
token_ttl = 60
|
|
token_policies = [
|
|
"kv/service/kubernetes/au/syd1/externaldns/tsig/read",
|
|
]
|
|
audience = "vault"
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "cert_manager_issuer" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "cert-manager-issuer"
|
|
bound_service_account_names = ["cert-manager-vault-issuer"]
|
|
bound_service_account_namespaces = ["cert-manager"]
|
|
token_ttl = 60
|
|
token_policies = [
|
|
"pki_int/sign/servers_default",
|
|
"pki_int/issue/servers_default",
|
|
]
|
|
audience = "vault"
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "ceph-csi" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "ceph-csi"
|
|
bound_service_account_names = ["ceph-csi-rbd-csi-rbdplugin-provisioner"]
|
|
bound_service_account_namespaces = ["ceph-csi"]
|
|
token_ttl = 60
|
|
token_policies = [
|
|
"kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read",
|
|
]
|
|
audience = "vault"
|
|
}
|